#KRYBIT
This tag brings together reporting on activity, analysis, and tracking tied to a campaign or group identified as KRYBIT within the cyberthreat landscape affecting Latin America. The archive covers tactics, operational shifts, likely targets, and regional context, with an emphasis on research findings and risk signals for organizations and users.
INCRANSOM Adds U.S. Victims
Security Arsenal detected 11 new INCRANSOM victims in five days, with cases in the U.S.
Sep 10, 2026 · 4 min
Jujuy Judiciary exposed by Emperador ransomware
Emperador leaked WordPress databases and credentials from Jujuy’s judiciary. The operation is still active and has another confirmed victim.
Sep 10, 2026 · 3 min
KRYBIT widens its campaign to Colombia
KRYBIT added 14 victims in 24 hours across 9 countries and more than 8 sectors, while CYFIRMA added Colombia and Chile as targets.
Sep 4, 2026 · 4 min
THEGENTLEMEN adds victims in Mexico
Security Arsenal logged 16 THEGENTLEMEN victims in 24 hours, with cases in Mexico, Brazil and Argentina and 31% in Latin America.
Sep 4, 2026 · 2 min
KRYBIT and LOCKBIT5 Add New Victims
KRYBIT, LOCKBIT5, and INC Ransom added new victims, with most activity centered on the United States and fresh listings in 48 and 24 hours.
Sep 2, 2026 · 3 min
KRYBIT Hits Brazil and Guatemala in 48 Hours
KRYBIT named 13 victims in 48 hours, including cases in Brazil and Guatemala. Health, agriculture, retail and finance were among the targets.
Sep 2, 2026 · 3 min